@wordkey/sdk 1.0.0 → 1.0.1

package/README.md

@@ -17,7 +17,16 @@ export function LoginPage() {
   return (
     <WordKeyButton
       publishableKey="wk_pub_xxxxxxxxxxxx"
-      onSuccess={(user) => console.log("Authenticated:", user)}
+      onSuccess={async (user) => {
+        // user.token is a single-use proof of authentication. Hand it to
+        // YOUR backend and verify it there (step 2) before creating a
+        // session — never trust user.id straight from the browser.
+        await fetch("/api/wordkey-login", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ token: user.token }),
+        });
+      }}
       onError={(err) => console.error(err)}
     />
   );
@@ -64,6 +73,10 @@ SDK automatically falls back to a full-page redirect and resumes your
 
 ## 2. Verify server-side
 
+The token your page received in `onSuccess` is single-use and business-bound:
+your server exchanges it with WordKey exactly once, over an authenticated
+server-to-server call. A replayed, expired, or foreign-business token throws.
+
 ```ts
 import { WordKey } from "@wordkey/sdk/server";
 
@@ -71,9 +84,10 @@ const wk = new WordKey({ secretKey: process.env.WORDKEY_SECRET_KEY! });
 
 export async function POST(req: Request) {
   const { token } = await req.json();
-  const user = await wk.verify(token);
+  const user = await wk.verify(token); // throws if invalid, reused, or expired
   // user.id        — permanent unique id for this WordKey user
   // user.isNewUser — true if this is their first authentication
+  // Safe to create your session for user.id now.
 }
 ```
 

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import * as react from 'react';
-import { W as WordKeyUser, a as WordKeyError, R as RequestedField } from './types-Be6QFOjD.mjs';
-export { A as Address, b as AuthEvent, C as CustomField, P as ProfileField, c as WordKeyProfile } from './types-Be6QFOjD.mjs';
+import { W as WordKeyUser, a as WordKeyError, R as RequestedField } from './types-B4z3Zton.mjs';
+export { A as Address, b as AuthEvent, C as CustomField, P as ProfileField, c as WordKeyProfile } from './types-B4z3Zton.mjs';
 
 interface WordKeyButtonProps {
     publishableKey: string;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
-import { W as WordKeyUser, a as WordKeyError, R as RequestedField } from './types-Be6QFOjD.js';
-export { A as Address, b as AuthEvent, C as CustomField, P as ProfileField, c as WordKeyProfile } from './types-Be6QFOjD.js';
+import { W as WordKeyUser, a as WordKeyError, R as RequestedField } from './types-B4z3Zton.js';
+export { A as Address, b as AuthEvent, C as CustomField, P as ProfileField, c as WordKeyProfile } from './types-B4z3Zton.js';
 
 interface WordKeyButtonProps {
     publishableKey: string;

package/dist/index.js

@@ -247,6 +247,7 @@ async function beginRedirectShare(input2) {
     requestId: input2.requestId,
     userId: input2.userId,
     isNewUser: input2.isNewUser,
+    token: input2.token,
     fields: input2.fields,
     privateKeyJwk
   };
@@ -449,6 +450,7 @@ function WordKeyButton({
         id: r.pending.userId,
         isNewUser: r.pending.isNewUser,
         authenticatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        token: r.pending.token,
         profile
       });
     });
@@ -524,7 +526,12 @@ function AuthModal({
     setStep("authenticating");
     try {
       const result = await verifyWord(apiUrl, publishableKey, word);
-      await completeAuth(result.userId, result.isNewUser, result.profileTicket);
+      await completeAuth(
+        result.userId,
+        result.isNewUser,
+        result.token,
+        result.profileTicket
+      );
     } catch (e) {
       if (e instanceof DeviceApprovalRequiredError) {
         await startDeviceApproval();
@@ -536,11 +543,12 @@ function AuthModal({
       onError({ code: "auth_failed", message });
     }
   }
-  async function completeAuth(userId, isNewUser, profileTicket) {
+  async function completeAuth(userId, isNewUser, token, profileTicket) {
     const finish = (profile) => onSuccess({
       id: userId,
       isNewUser,
       authenticatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      token,
       profile
     });
     if (fields.length === 0) {
@@ -557,7 +565,8 @@ function AuthModal({
         ticket: profileTicket,
         fields,
         userId,
-        isNewUser
+        isNewUser,
+        token
       });
       return;
     }
@@ -629,11 +638,12 @@ function AuthModal({
         const userId = claims?.userId ?? "";
         const isNewUser = claims?.isNewUser ?? false;
         if (fields.length === 0) {
-          await completeAuth(userId, isNewUser, data.profileTicket);
+          await completeAuth(userId, isNewUser, data.token, data.profileTicket);
         } else {
           pendingApproval.current = {
             userId,
             isNewUser,
+            token: data.token,
             profileTicket: data.profileTicket
           };
           setStep("approved");
@@ -738,7 +748,8 @@ function AuthModal({
             style: primaryBtn(false),
             onClick: () => {
               const p = pendingApproval.current;
-              if (p) void completeAuth(p.userId, p.isNewUser, p.profileTicket);
+              if (p)
+                void completeAuth(p.userId, p.isNewUser, p.token, p.profileTicket);
             },
             children: "Continue"
           }

package/dist/index.mjs

@@ -207,6 +207,7 @@ async function beginRedirectShare(input2) {
     requestId: input2.requestId,
     userId: input2.userId,
     isNewUser: input2.isNewUser,
+    token: input2.token,
     fields: input2.fields,
     privateKeyJwk
   };
@@ -409,6 +410,7 @@ function WordKeyButton({
         id: r.pending.userId,
         isNewUser: r.pending.isNewUser,
         authenticatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        token: r.pending.token,
         profile
       });
     });
@@ -484,7 +486,12 @@ function AuthModal({
     setStep("authenticating");
     try {
       const result = await verifyWord(apiUrl, publishableKey, word);
-      await completeAuth(result.userId, result.isNewUser, result.profileTicket);
+      await completeAuth(
+        result.userId,
+        result.isNewUser,
+        result.token,
+        result.profileTicket
+      );
     } catch (e) {
       if (e instanceof DeviceApprovalRequiredError) {
         await startDeviceApproval();
@@ -496,11 +503,12 @@ function AuthModal({
       onError({ code: "auth_failed", message });
     }
   }
-  async function completeAuth(userId, isNewUser, profileTicket) {
+  async function completeAuth(userId, isNewUser, token, profileTicket) {
     const finish = (profile) => onSuccess({
       id: userId,
       isNewUser,
       authenticatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      token,
       profile
     });
     if (fields.length === 0) {
@@ -517,7 +525,8 @@ function AuthModal({
         ticket: profileTicket,
         fields,
         userId,
-        isNewUser
+        isNewUser,
+        token
       });
       return;
     }
@@ -589,11 +598,12 @@ function AuthModal({
         const userId = claims?.userId ?? "";
         const isNewUser = claims?.isNewUser ?? false;
         if (fields.length === 0) {
-          await completeAuth(userId, isNewUser, data.profileTicket);
+          await completeAuth(userId, isNewUser, data.token, data.profileTicket);
         } else {
           pendingApproval.current = {
             userId,
             isNewUser,
+            token: data.token,
             profileTicket: data.profileTicket
           };
           setStep("approved");
@@ -698,7 +708,8 @@ function AuthModal({
             style: primaryBtn(false),
             onClick: () => {
               const p = pendingApproval.current;
-              if (p) void completeAuth(p.userId, p.isNewUser, p.profileTicket);
+              if (p)
+                void completeAuth(p.userId, p.isNewUser, p.token, p.profileTicket);
             },
             children: "Continue"
           }

package/dist/server.d.mts

@@ -1,5 +1,5 @@
-import { W as WordKeyUser, b as AuthEvent } from './types-Be6QFOjD.mjs';
-export { A as Address, a as WordKeyError, c as WordKeyProfile } from './types-Be6QFOjD.mjs';
+import { W as WordKeyUser, b as AuthEvent } from './types-B4z3Zton.mjs';
+export { A as Address, a as WordKeyError, c as WordKeyProfile } from './types-B4z3Zton.mjs';
 
 interface WordKeyConfig {
     /** Your SECRET key (wk_sec_...). Server-only — never ship it to a browser. */

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { W as WordKeyUser, b as AuthEvent } from './types-Be6QFOjD.js';
-export { A as Address, a as WordKeyError, c as WordKeyProfile } from './types-Be6QFOjD.js';
+import { W as WordKeyUser, b as AuthEvent } from './types-B4z3Zton.js';
+export { A as Address, a as WordKeyError, c as WordKeyProfile } from './types-B4z3Zton.js';
 
 interface WordKeyConfig {
     /** Your SECRET key (wk_sec_...). Server-only — never ship it to a browser. */

package/dist/{types-Be6QFOjD.d.mts → types-B4z3Zton.d.mts}

@@ -33,6 +33,15 @@ interface WordKeyUser {
     /** True on the user's first-ever authentication (i.e. account creation). */
     isNewUser: boolean;
     authenticatedAt: string;
+    /**
+     * Single-use verification token. Send it to your backend and call
+     * `wk.verify(token)` there — the id/isNewUser fields on this object are
+     * client-side claims and MUST NOT be trusted for anything security-relevant
+     * until your server has verified this token. Always present on users
+     * delivered by WordKeyButton onSuccess (SDK >= 1.0.1); absent on the result
+     * of `wk.verify` itself, which spends the token.
+     */
+    token?: string;
     /** Present only when requestedFields were granted; unfilled fields omitted. */
     profile?: WordKeyProfile;
 }

package/dist/{types-Be6QFOjD.d.ts → types-B4z3Zton.d.ts}

@@ -33,6 +33,15 @@ interface WordKeyUser {
     /** True on the user's first-ever authentication (i.e. account creation). */
     isNewUser: boolean;
     authenticatedAt: string;
+    /**
+     * Single-use verification token. Send it to your backend and call
+     * `wk.verify(token)` there — the id/isNewUser fields on this object are
+     * client-side claims and MUST NOT be trusted for anything security-relevant
+     * until your server has verified this token. Always present on users
+     * delivered by WordKeyButton onSuccess (SDK >= 1.0.1); absent on the result
+     * of `wk.verify` itself, which spends the token.
+     */
+    token?: string;
     /** Present only when requestedFields were granted; unfilled fields omitted. */
     profile?: WordKeyProfile;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wordkey/sdk",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Add the Word? button to your site in one afternoon. One word. Every door.",
   "license": "SEE LICENSE IN LICENSE",
   "main": "./dist/index.js",